Collaborate Disseminate
The Web Authentication API allows websites served via HTTPS to allow users to authenticate via asymmetric encryption. The procedure for login is basically the following:
Server sends a challenge (16 random bytes);
Client signs the challen… Continue reading What are the benefits of using WebAuthn?
So I have this application with a web frontend where users can exchange data in an end-to-end encrypted fashion.
Those users each have a client-side generated RSA keypair. The public part is stored in the server’s database to be used when … Continue reading Store or protect a secret with a WebAuthn device
I’m trying to learn a bit about authentication and security protocols at a 10,000 foot level. I was reading about WebAuthn here: https://webauthn.guide/ and here:
https://webauthn.io/
I’m sure what I’m about to ask has obvious answers, bec… Continue reading WebAuthn – What am I missing?
In episode 128 for July 6th 2020: In episode 128 for July 6th 2020: New TikTok privacy concerns, the rise of macOS ransomware, and details on new research about bad password choices. ** Links mentioned on the show ** Family Safety and Security with And… Continue reading TikTok Privacy Concerns, macOS Ransomware, Bad Passwords
Mozilla is fixing a longstanding password problem to alert users when their password exceeds the maximum length allowed. Continue reading Firefox to tell you if sites are shortening your passwords
In episode 118 for April 27th 2020: A discussion about the end of passwords and what the future may hold with special guest Andrew Shikiar executive director of the FIDO Alliance. ** Show notes and links mentioned on the show ** Find out more about the… Continue reading The End of Passwords as We Know It
If a website user wants to use WebAuthn, they will start by creating a credential, where their authentication device provides a public key.
This key is encoded, and sent back to the server to store against their account.
Later, when the … Continue reading Risks with OpenSSL verifying a signature with un-trusted PEM encoded public key
OpenSK is a piece of firmware that you can install on a USB dongle of your own, turning it into a usable FIDO or U2F key. Continue reading Google launches open-source security key project, OpenSK
As I read through the WebAuthn / FIDO2 documentation, it appears the authentication is done on the local device to create an attestation to the FIDO server. This future implies the “biometrics” or other Authenticator means m… Continue reading WebAuthn Variation with non-connect dongle Authenticator
Webauthn supports authentication or multi factor authentication with either hardware keys or authentication features that are built into the device used (Windows Hello, Android with a Fingerprint, …).
Given the case that a… Continue reading How to add a new webauthn key if the existing one isn’t portable